The vulnerability is an improper control of code generation flaw in the Widget Wrangler plugin that allows an attacker to inject and execute arbitrary code. This code injection (CWE‑94) effectively grants remote execution capabilities, letting an attacker run any command on the WordPress server and potentially take full control of the site. The impact is catastrophic, compromising confidentiality, integrity, and availability of the entire website and any data it hosts.

The affected product is the Widget Wrangler plugin, developed by Jonathan Daggerhart. All versions from the earliest release up to and including 2.3.9 are vulnerable. There is no minimum version noted; therefore any installation of 2.3.9 or older is at risk.

The CVSS base score of 9.1 indicates a high‑severity vulnerability. EPSS data is not available, so the probability of exploitation cannot be precisely quantified. The vulnerability is not listed in CISA’s KEV catalog, but the nature of the flaw—remote code execution via a plugin that can be accessed by anyone with access to the website’s admin interface—suggests that exploitation is feasible even without privileged credentials. Attackers would likely craft a malicious request to the plugin’s code generation endpoint to inject code.